ex art. 13 of Regulation (EU) 679/2016 (General Data Protection Regulation – GDPR)

Premise

This page describes the management methods of the site in relation to the processing of personal data of the site users. www.500clubitalia.it (hereinafter only “Site”). Users of the site can be simple visitors, or register with the Club as Members, use the newsletter service, register and create an account or, again, purchase on the e-commerce and/or use all the update services provided by the Fiat 500 Club Italia Association through the Site.

This is the information provided pursuant to European Regulation 2016/679 and Legislative Decree 196/2003 – Personal Data Protection Code to those who interact with the web services of the Fiat 500 Club Italia Association.

It is useful to remember, in this regard, that Regulation (EU) 679/2016 (General Data Protection Regulation – GDPR) defines “personal data” as any information relating to an identified or identifiable natural person (“data subject”).

According to the GDPR, "processing" means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

The information is provided only for this site and not for other websites that may be consulted by the user through links accessible from this site.

The information describes some minimum requirements for the collection of personal data online, and, in particular, the methods, times and nature of the information that data controllers must provide to users when they connect to web pages, regardless of the purposes of the connection.

Data Controller and Data Protection Officer (DPO)

The Data Controller is the Fiat 500 Club Italia Association, with registered office in Via Roma n. 90 – 17033 Garlenda (SV), VAT number 01079820096 – Tel: 0182.582282 – E-mail: info@500clubitalia.it

The Data Protection Officer (DPO) is Avv. Eleonora Mataloni, with office in Lecco (LC), 23900 Via Balicco n. 61, contactable at the following email addresses: eleonora.mataloni@virgilio.it;  dpo@500clubitalia.it

 Types of data processed and purpose of treatment

The processing operations are carried out with reference only to the personal data necessary for the use of the Site and its functions. The types of data subject to processing include, in particular:

1. navigation data: the computer systems and software procedures used to operate the Site acquire, during their normal operation, some personal data whose transmission is implicit in the use of Internet communication protocols. This information is not collected to be associated with identified interested parties, but by its very nature could, through processing and association with data held by third parties, allow users to be identified. This data is used for the sole purpose of obtaining anonymous statistical information on the use of the site and to check its correct functioning and is not, nor will it be used in any case by the Data Controller to carry out profiling activities.

For more information on the collection, use and storage times of browsing data, please refer to cookie policy

1. data provided voluntarily by the user, in particular:

• e-mail address and other personal data possibly contained in e-mail messages sent to the addresses indicated on the Site, in order to carry out the processing activities necessary to provide feedback to the user's requests;
• name, surname, address, personal data, e-mail address provided by filling in the form "Sign Up” to proceed with the online registration to the Association, in order to become a member and actively participate in all the initiatives of Fiat 500 Club Italia and receive informative communications also having commercial and promotional content on the owner's activity and on its services and events on a periodic basis.

The user may unsubscribe from the service at any time by following the procedure indicated in each newsletter and/or by writing to the contact details provided at the bottom of this information notice, exercising the right to object pursuant to art. 21 GDPR

• name, email address and any other personal data provided by filling in the contact and information request forms "Contact us”, in order to respond to user requests;
• The Site also offers a section dedicated to the Forum where the User can publish their opinions and comments; for this purpose the personal data requested are address Username and Password. If this data is not provided, it will not be possible to publish on our Forum, but it will be possible in any case to use the other services of the Site.

Account

Where the User creates his/her own personal account, his/her data will be processed to allow his/her registration on the site and the management of his/her reserved area, and to send informative communications also having commercial and promotional content on the owner's activity and on his/her products. The owner may receive the user's identification and contact data from Facebook or Google, in the case of user login through Facebook and Google+. The personal account involves the use of authentication credentials that are known only to the user, and that the latter must keep carefully and under his/her full and exclusive responsibility.

Registering on the site allows you to benefit from some advantages, such as invitations to exclusive promotions, birthday discounts and an easier check-out procedure for online purchases. Creating an account is mandatory/necessary to make online purchases.

The legal basis for such processing is the need to execute a contract to which the user is a party and/or pre-contractual measures adopted at the user's request, and to comply with related legal obligations; with regard to the sending of informative communications with commercial and promotional content, such processing finds its legal basis in the legitimate interest of the Fiat 500 Club Italia Association to promote its activity and its products, and is compatible with the position of the interested parties because it is reasonable to believe that those who create an account on the site have an interest in staying informed about the activities and promotions of the Fiat 500 Club Italia Association.

Online shopping

Where the user makes online purchases, his/her data will be processed (i) to manage purchase orders (including the sending of informative and service communications on the status of the order, via email; the execution of the related shipments; pre- and post-sales customer assistance), as well as (ii) to send informative communications also having commercial and promotional content on the owner's activity and on its products and services.

The legal basis for the processing is constituted by:

– for the processing under (i), from the need to execute a contract to which the user is a party and/or pre-contractual measures adopted at the user's request, and to comply with the related legal obligations;

– as regards the processing under (ii) from the legitimate interest of the Fiat 500 Club Italia Association to promote and improve its activity and its products, and is compatible with the position of the interested parties because it is reasonable to believe that those who make a purchase on the site have an interest in staying informed about the activities and promotions of the Fiat 500 Club Italia Association as well as in expressing their opinion on their purchasing experience.

The Data Controller, in fact, uses the so-called "soft spam" pursuant to art. 130 of the Privacy Code. This means that without having to acquire your express consent, we can use the email address you provided in the context of a previous purchase with the Fiat 500 Club Italia Association, in order to proceed, by sending via email, to commercial communications and sales offers, provided that they relate to products and services similar to those you have already purchased.

Upon receipt of any communication and/or promotional email made by the Fiat 500 Club Italia Association for the purposes described above, you are informed of the possibility of objecting to the processing pursuant to art. 21 GDPR at any time, easily and free of charge, and you may communicate your declaration of revocation of consent by writing to the address of Via Tagliamento, 32 – 23900 Lecco (LC), or to the email address amministrazione@500clubitalia.it. In the event that the preference in relation to consent is given more than once (for example, because multiple purchases are made or because an account is created and a purchase is made), the choice made last will prevail.

The processing of the user's data is necessary only for the completion of the purchase procedure, for the subsequent delivery of the products and for customer support activities. The user may object at any time to receiving commercial and promotional communications from the owner, as well as customer satisfaction surveys and inquiries, and such objection will have, as its only consequence, the loss of the possibility of receiving offers that may be of interest to the user and of contributing to improving the products and services of the owner. The objection may be exercised by following the procedure indicated at the bottom of the communications themselves or by contacting the owner by writing to the email address amministrazione@500clubitalia.it

Nature of data transfer

It is specified, in any case, that the user is free to provide the requested data, in the sense that he is not legally obliged to provide them: failure to provide the data indicated as necessary, however, makes it impossible to obtain what is requested.

The data provided by the user may be acquired and stored by the Owner, even in electronic form, for the purposes connected to their collection through the Site and will not be used for profiling or direct marketing activities.

Furthermore, the user can access the “500 Shop” section and other related subsections through the Site. For all information on the processing of personal data carried out for the provision of the services offered through the aforementioned links, please refer to the respective privacy policies.

Method of treatment

The processing will be carried out, mainly using IT tools, by collaborators and employees authorised to do so, who operate according to the instructions given by the Data Controller, with logic strictly related to the purposes indicated and, in any case, in a way that guarantees the security and confidentiality of the data processed.

Specific security measures are adopted in order to minimize the risks of destruction or loss, even accidental, of the data being processed, of unauthorized access, of unauthorized or non-compliant processing with respect to the purposes indicated in this information notice.

Data retention period

The data subject to processing will be retained for a period of time not exceeding that necessary to achieve the purposes for which they were collected or subsequently processed and, in particular:

• the data provided by sending emails or filling in the forms form contact details on the site will be retained for the time necessary to provide feedback;
• the data provided for the purpose of registering for the newsletter service will be processed until the right of opposition is exercised ex21 of the GDPR by the interested party;

The Data Controller will, after the expiry of the retention terms according to the indicated criteria, adopt measures aimed at the cancellation or anonymization of data that do not need to be retained due to specific regulatory obligations.

Categories of recipients

The personal data of the interested party may be communicated to:

• collaborators and employees of the Fiat 500 Club Italia Association specifically authorised, within the scope of their respective competences
• commercial agents appointed by the Data Controller, in their capacity as independent Data Controllers;
• suppliers of services offered through the Site or connected to its operation, including MailUp® (registered trademark of Growens SpA) for the Newsletter service;
• Studio Arkeba as a supplier of development, delivery and operational management services for the technological platforms of the sites accessible electronically at the following addresses  https://www.500clubitalia.it e https://puntoamico.500clubitalia.it 
• Studio Arkeba for web hosting service;
• shippers and carriers (BRT spa) for the management of deliveries of products purchased on e-commerce

These subjects will process the data, depending on the case, as independent data controllers, or as data processors by virtue of a specific written assignment given to them by the data controller.

Except for the cases mentioned above, personal data will not be communicated, disseminated, ceded or in any way transferred to third parties for illicit purposes or not connected to the purposes of the collection and, in any case, without providing suitable information to the interested parties and acquiring their consent, where required by law. The possible communication of data upon request of the Judicial Authority or Public Security remains valid, in the ways and cases provided by law.

Personal data will not be transferred abroad, to countries or international organizations outside the European Union that do not guarantee an adequate level of protection, recognized, pursuant to art. 45 GDPR, on the basis of an adequacy decision by the EU Commission. In the event that it is necessary for the provision of the services of the Site, the transfer of personal data to countries or international organizations outside the EU, for which the Commission has not adopted any adequacy decision pursuant to art. 45 GDPR, will take place only in the presence of adequate guarantees provided by the recipient country or organization, pursuant to art. 46 GDPR and provided that the interested parties have enforceable rights and effective remedies.

In the absence of an adequacy decision by the Commission pursuant to Article 45 GDPR or appropriate safeguards pursuant to Article 46 GDPR, including binding corporate rules, the cross-border transfer will take place only if one of the conditions set out in Article 49 GDPR applies.

Rights of the interested party

The interested party is recognized the right to access his/her personal data, to request rectification, updating and cancellation or limitation, if incomplete, erroneous or collected in violation of the law, as well as to oppose the processing for legitimate reasons or to obtain portability.

The interested party, in particular, pursuant to articles 15-22 of Regulation (EU) 679/2016, has the right to obtain confirmation of the existence or otherwise of personal data concerning him, even if not yet registered, and their communication in an intelligible form.

The interested party also has the right to obtain the indication:

1. a) the purposes and methods of processing;
2. b) the logic applied in case of processing carried out with the aid of electronic instruments;
3. c) the identifying details of the Data Controller, the Data Processor and the subjects or categories of subjects to whom the personal data may be communicated or who may become aware of them as persons authorised to process them.

The interested party has the right to obtain:

1. a) the updating, rectification or integration of your data;
2. b) the cancellation, transformation into anonymous form or blocking of data processed in violation of the law, including data whose retention is not necessary in relation to the purposes of the processing;
3. c) the limitation of processing, when one of the hypotheses referred to in Article 18 GDPR occurs;
4. d) certification that the operations referred to in letters a), b) and c) have been brought to the attention of those to whom the data have been communicated or disclosed, except in the case where such fulfillment proves impossible or involves the use of means manifestly disproportionate to the right protected;
5. e) the transmission of data concerning him/her, provided to the Data Controller and processed on the basis of the consent expressed by the interested party for one or more specific purposes, in a structured, commonly used and machine-readable format. Pursuant to art. 20 of the GDPR, the interested party also has the right to transmit such data to another Data Controller without hindrance and, if technically feasible, to obtain direct transmission of personal data from one Data Controller to another.
6. f) if the processing is based on consent, withdraw your consent at any time (pursuant to art. 7, par. 3 GDPR).

The interested party has the right to object, in whole or in part:

1. a) for legitimate reasons the processing of personal data, pertinent for collection purposes;
2. b) to automated decision-making processes that significantly affect him/her.

Without prejudice to any other administrative or judicial remedy, the interested party has the right to lodge a complaint and/or report to a supervisory authority, in particular in the Member State in which he/she habitually resides, works or where the alleged infringement occurred.

Exercise of rights

The above rights are exercised by making a request to the Data Controller, directly or through an authorised person, orally or by sending an email to the address amministrazione@500clubitalia.it

The request is formulated freely and without formalities by the interested party, who has the right to receive an appropriate response within a reasonable time, depending on the circumstances of the case.

The interested party may avail themselves, for the exercise of their rights, of non-profit bodies, organizations or associations, whose statutory objectives are of public interest and which are active in the sector of protection of the rights and freedoms of the interested parties with regard to the protection of personal data, granting, for this purpose, a suitable mandate. The interested party may also be assisted by a trusted person.

You can receive more information on the purposes and methods of processing of personal data by writing to the email address amministrazione@500clubitalia.it indicating “Privacy” in the subject.

To know your rights, lodge a complaint and always be updated on the legislation regarding the protection of individuals with regard to the processing of personal data, the interested party can contact the Authority for the protection of personal data, by consulting the website at http://www.garanteprivacy.it/.

Right of complaint

Interested parties who believe that the processing of personal data referring to them carried out through this site is in violation of the provisions of the Regulation have the right to lodge a complaint with the Guarantor, as provided for by art. 77 of the Regulation itself, or to take the appropriate judicial seats (Article 79 of the Regulation).

Integrations

In the event of substantial changes to this information, the owner will send a notification via email and/or publish a notice on the site to report the changes and collect any requests to exercise the rights described above.

Use of cookies

With regard to the methods of use of cookies, please refer to the additional and specific EXTENDED INFORMATION published in the following section at cookie policy of the site and drawn up in accordance with the provisions of the Provision of 8 May 2014 issued by the Italian Guarantor for the protection of personal data, which integrates and completes this document.

Privacy Policy updated April 2023